Is it Microsoft? It has a mechanism by which an email can also make a calendar appointment. I think there's a setting to disable those automatic appointments, but a savvy spammer using the O365 API might be able to bypass it.
I've had this happen to me, too.
